open-standards/joulecontract/archive/joulecontract-spec-v0.5.md

JouleContract

An Open Standard for Energy-Accounted Interface Contracts

Status	Draft for Review
Version	0.5.0 — amends 0.4.0 (see Amendment Log, §16)
Canonical home	joulecontract.transaction.science
License	Specification text: CC-BY-4.0 · Reference implementation: Apache-2.0 (Rust)
Stewardship	The protocol is ownerless. Stewardship is an office, not an owner (§11). Transaction Science, Inc. is the inaugural steward.
Position	The operand between JouleCode, JouleProof, and JouleClaw; denominated in the EOC joule unit; readiness scored by ARL.
Prime directive	Energy optimization, safety, and auditability — served by one receipt, not three programs. Every point of failure is named, graded, and traced; the one residual the entire assurance canon shares is named, not hidden (§10.1).

---

0. Self-Hosting Clause

This specification is governed by its own amendment model. Each published version is a content-addressed document; each new version is an attributed, reasoned, signed amendment chained to the digest of the version it amends (§16). No version of this standard depends on any person, organization, algorithm, or jurisdiction remaining in place: every named fixed point in this document is an office or a parameter with a defined succession or migration rule, not a dependency.

Self-hosting is literal, not rhetorical: amendments to contracts are themselves JouleContract transitions, metered and receipted under §5.2.

---

1. Design Principle: Inherit, Don't Invent — and Bind, Don't Name

The three concerns this standard serves — energy optimization, safety, auditability — each have a mature, internationally recognized management-system standard. JouleContract does not replace them. It is the technical control object whose single signed receipt simultaneously discharges evidence for functional safety (IEC 61508), energy management (ISO 50001 with ISO/IEC 30134), and AI governance (ISO/IEC 42001) — three programs collapsed into three projections of one receipt log.

Where an inherited standard is superseded, the inheritance binds to the current edition of that standard or its formally designated successor; this specification names roles ("the functional-safety standard," "the energy-management system"), with current editions listed in the non-normative Register (§13), so the standard does not break when the canon revises.

The binding rule (normative, global). A trust-bearing field is one whose value, if false, would cause a reader to over-trust the receipt: generator, frame, qualification, independent, verifier, provenance, timestamps. Every trust-bearing field MUST be bound — derivable from or verified against a key, a resolvable signed attestation, or an independent timestamp — or MUST serialize in a demoted form (*_unattested, undischarged, qualified:false, self_attested) that a reader and a profile can act on. A field that is named but not bound does not exist in a conformant receipt: there is no implicit trust anywhere, including in the vocabulary this standard itself introduces.

---

2. Normative Inheritance

Conformant implementations MUST be expressible in terms of the following, by role:

2.1 Safety — the functional-safety standard and the avionics assurance family

Two independently-evolved lineages are inherited, each on its own authority:

• IEC 61508 (currently Ed. 2) and its aligned sector standards (ISO 26262 automotive, IEC 62304 medical, EN 50128 rail): goal-based assurance — risk-reduction targets demonstrated through structured evidence across a defined lifecycle, formal methods admitted as assurance techniques, graded by Safety Integrity Level (SIL 1–4). JouleContract inherits the assurance-case-as-evidence model (the receipt log is the assurance case), the SIL grade, and RFC 2119 normative discipline.
• The avionics assurance family (DO-178C/ED-12C with supplements DO-330 tool qualification and DO-333 formal methods), which predates IEC 61508 and evolved independently — its objective-based discipline (objectives outlive procedures), tool-qualification regime, and formal-methods soundness requirements are inherited where high assurance is claimed (§6.1, §10).

2.2 Energy — the energy-management system (currently ISO 50001) + the measurement-KPI series (currently ISO/IEC 30134)

The joule ceiling is an Energy Performance Indicator (EnPI) against a declared Energy Baseline (EnB); the ratchet (§5.3) is the continual-improvement loop; the provenance tag (§4.2) is the measurement category, with Unaccounted bound to the series' unaccounted-energy rules.

2.3 Governance — the AI management system (currently ISO/IEC 42001 and family: 23894, 42005, 42006, 42007, 38507, 5338)

The AIMS is the wrapper JouleContract operates inside; the amendment model (§5.2) is its change control; the contract is a control object within an AIMS, not a competing system.

2.4 Assurance, evidence, and trust

ISAE 3000 / SOC 2 (independent attestation reads the receipts) · eIDAS qualified signatures/seals/timestamps (EU legal effect; qualified timestamps anchor the temporal-ordering invariant, §5.2.1) and FIPS 140-3 validated cryptography (US federal boundaries) · in-toto / SLSA / DSSE / Sigstore (supply-chain envelope at the recognized edge, §7) · NIST SP 800-218 SSDF and the 800-218A generative-AI community profile (the organizational practices the receipt log evidences) · ISO 19011 (the audit is a query over the receipt log).

---

3. The Core Object

A JouleContract is a content-addressed object bound to a unit of work, declaring five obligations:

1. Precondition (pre) — MUST hold for the transition to be admissible.
2. Postcondition (post) — MUST hold once the transition completes.
3. Invariant (inv) — MUST hold throughout and survive the boundary unchanged.
4. Frame (frame) — the declared mutable footprint: the complete set of state the transition is permitted to touch. All state outside the frame is implicitly invariant. (See §3.4.)
5. Joule ceiling (ceiling) — maximum energy, in the EOC joule unit, expressed as an EnPI against a declared EnB.

3.1 Identity and cryptographic agility

A contract MUST be content-addressed by the digest of its canonical serialization. The digest MUST be algorithm-prefixed (multihash-style: sha2-256:…, sha3-256:…), and conformant implementations MUST support digest-algorithm migration: when an algorithm is deprecated by the steward (§11) on published cryptanalytic grounds, existing objects are re-anchored by a signed cross-digest amendment mapping old identity to new. No object's validity depends on the permanence of any single hash function or signature scheme. This discipline applies to every identity in a contract or receipt, including the generator's version digest (§5.1.1): human-readable names (model, system, tier labels) are non-normative labels; the algorithm-prefixed digest is the identity.

3.2 Correctness stays the verifier's

A contract states a specification; it does not certify itself. A proof is not a specification: discharge establishes that an implementation satisfies the stated obligations, not that those were the right obligations. Conformant systems MUST keep correctness with an independent verifier of record (§6).

3.3 Composition

Contracts compose. A contract over a composed transition (a batch, a pipeline, a workflow) is the conjunction of its components' obligations with a ceiling no greater than the sum of component ceilings, and a frame no larger than the union of component frames. Composition is associative; receipts for a composed transition MUST reference the component receipts or carry the composed discharge directly.

Composition never relicenses. The composed frame bounds the aggregate; each component remains bound by its own declared frame within the composition. A component's effect outside its own frame is a breach of that component's contract even where the effect falls inside the composed frame. If any component's frame is undischarged (§3.4), the composed frame is undischarged, carrying a reference to the offending component — an unbounded leaf surfaces at the top of the composition; it never silently disappears into a union.

Decomposition — discharging one high-assurance obligation across redundant lower-rated elements (the ISO 26262 ASIL-decomposition pattern) — is expressed as conjunction over the composing contracts only where the composing elements are demonstrably independent: freedom from interference plus absence of common-cause failure, recorded via the per-discharge independence binding (§6.2) and a dependent-failure rationale carried in the profile (§10). Absent demonstrated independence, the conjunction does not lower the required tier of any element; the original high-assurance obligation stands undecomposed. (Conjunction alone carries no independence guarantee; the precondition is what makes the pattern valid.)

3.4 The frame obligation — no unintended function

pre/post/inv establish what a transition guarantees; none of them bounds what it may additionally do. A transition can satisfy every stated obligation while mutating state nobody declared — the frame problem. The frame closes it: anything not named in frame is implicitly invariant, so an effect outside the declared footprint is a breach (§5.2) exactly as a violated postcondition is. This is the standard's form of two independently-evolved canon requirements — DO-178C's absence of unintended function and ISO 26262's freedom from interference between partitions.

There is no closed unbounded frame. Where a transition's full footprint cannot be bounded, the frame obligation serializes as undischarged with a reason — the same demoted category every other unclosable obligation uses (§5.1). An undischarged frame is never a free pass: it is non-promotable, it caps the achievable Safety class (no SIL-3 or above may be claimed over an undischarged frame, §10), and it propagates to the top of any composition (§3.3). A declared-but-unverifiable footprint and an undeclared footprint are the same epistemic state, and the receipt says so. (A "disclosed unbounded frame" treated as a closed discharge would reopen, relabeled, the exact hole this clause exists to close; that construction is therefore not defined.)

Frame discharge mode. Each frame discharge MUST record its mode: observed (the verifying tier monitored the actual execution footprint) or static_only (the footprint was bounded by analysis of the artifact without observing execution). static_only is a weaker claim — declared-and-analyzed, not observed-and-confined — and high-assurance profiles MAY require observed. Because the frame is the one obligation that bounds unstated effects, frame discharge MUST be independent of the generator (per §6.2's key-disjointness rule) at SIL-2 and above.

---

4. Energy as Coordinate

Energy is the coordinate system, not a feature. The joule is the only unit present in every transition in every domain; that shared unit is what places a refactor, a settlement, and a clinical handoff on one ledger under one audit.

4.1 The ceiling is the one measured clause

Correctness clauses are binary; the ceiling yields a measured residual (allowed − spent) — the continuous signal that improvement loops and energy disclosures (CSRD/ESRS E1) sum over.

4.2 Energy provenance = measurement category

Every joule figure MUST carry one of: Metered (hardware-measured) > ModelBased (anchored to a metered baseline for a comparable workload) > Unaccounted (estimated by published energy-traceability methods where the substrate exposes nothing). The tag MUST travel with the number; downstream consumers MUST NOT promote a category. The failure prevented is estimation laundering itself into apparent measurement.

4.3 Cross-domain ledger rule

The ledger is additive across domains and comparative only within an EnB scope.

The joule is an SI unit; sums of joules are physically meaningful regardless of domain, so a global ledger MAY total compute-joules and operational work-joules for aggregate disclosure. But an EnPI is meaningful only against its own baseline: a contract's residual is comparable to other residuals under the same EnB, and never constitutes an equivalence claim across EnBs. A handoff's joules and a refactor's joules add on the ledger; they are never exchanged, ranked, or netted against each other. Receipts MUST carry the EnB reference, and conformant ledgers MUST refuse cross-EnB comparison operations while permitting cross-EnB summation. (No false equivalence is possible by construction, because the comparison operation that would assert it is not defined.)

4.4 Resource-bound lineage (precise claim)

Resource-bound verification is not new: the functional-safety canon already verifies time (WCET) and memory (stack/heap bounds) as objectives. JouleContract does not claim to verify resources for the first time. It generalizes resource-bound verification from time and memory to energy, and makes the bound a billed, receipted, ratcheting EnPI rather than a one-time certification objective.

---

5. The Receipt, the Amendment, and the Ratchet

The contract is the promise; the receipt is the record that the promise held — the unit of evidence for all three inherited management systems at once. Any compliance report is a projection over the receipt log.

5.1 Required receipt fields

contract · transition · generator (§5.1.1) · discharge (per obligation — pre/post/inv/frame — each carrying: tier that closed it or undischarged + reason; the tier's class and qualification binding (§6.1); the discharging verifier identity and computed independence (§6.2); and for frame, the discharge mode, §3.4) · execution · joules_spent · joules_allowed · residual · provenance · enb_ref · grid_mix (OPTIONAL) · verifier (the derived union of per-discharge verifier identities) · profile (§10) · timestamp (§5.2.1) · signature.

5.1.1 Generator identity — bound, not named

The receipt MUST identify the producer of the work: the AI system or human author, the generation context, and the human principals involved — AI-BOM-compatible, the producer-identity that SLSA/in-toto carry for builders and OWASP AISVS (Appendix C, control AC.9.1, a Level-2 control) requires for AI-generated artifacts.

Identity is bound, not asserted: generator.version_digest MUST be an algorithm-prefixed content address (§3.1) resolving to a producer attestation (model card, in-toto Statement, or inference-environment attestation) signed by a key distinct from the receipt signer. A generator identity that does not resolve, or whose attestation is signed only by the receipt signer, MUST serialize as generator_unattested with a reason; an unattested generator is non-promotable and caps the Governance class (§10) — recorded as untrusted rather than presented as clean. Human-readable system/model strings are non-normative labels (§3.1); the digest is the identity. A correctness-and-energy receipt that named its producer without binding the name would be weaker provenance than the plain supply-chain attestation it wraps; the binding closes that.

5.1.2 Trust-chain termination — no unterminated recursion

Every trust chain in this standard terminates at one of two defined roots, and the receipt names which:

• human-attested — a signed attestation by a named human principal (the assessor of record, the human author). The human principal is the root of trust; there is no contract behind the human.
• reference-impl — a published deterministic artifact whose soundness is a cited proof or public reference implementation under §3.1/§7 (e.g., a type checker with a published soundness proof).

This rule grounds both recursions the standard would otherwise contain: the qualification chain (a qualification attestation is itself trusted output; its chain MUST terminate at human-attested or reference-impl rather than recursing — the same termination the tool-qualification canon uses, where qualification grounds in assessor and certification-authority sign-off, not in another tool) and the generator chain (a generator governed by its own contract, §6.3, names its own generator; that chain MUST terminate at a human-authored generator). A chain that does not reach a defined root within the receipt's referenced objects serializes as unterminated and is treated as unattested.

5.2 Amendment model

Every amendment to a contract — including to its ceiling or its frame — is an attributed, reasoned, signed transition chained to the prior digest. The contract is its own amendment log. Breach is deviation without a matching amendment; a measured overrun, or an out-of-frame effect, with a signed, reasoned amendment is governed change — subject to the temporal-ordering invariant (§5.2.1).

Amendments are metered. An amendment is itself a JouleContract transition: it bears a ceiling, spends joules, and produces a receipt (§0). Change to the ledger is never free of the ledger.

5.2.1 Temporal-ordering invariant — amendments govern the future only

An amendment MUST carry a timestamp from an independent timestamp authority (eIDAS qualified timestamp or equivalent, §2.4) and governs only effects whose receipts are timestamped after it. An out-of-frame effect or ceiling overrun whose receipt predates the relevant amendment is, and permanently remains, a breach: an amendment changes future obligations; it never reclassifies a past effect. (Without this invariant, "amend-or-fix" would admit retroactive legalization — detect the breach, widen the frame, call it governed change. The ordering is anchored outside the producer precisely because ordering is otherwise producer-controlled.)

At SIL-3 and above, frame and ceiling amendments MUST carry quorum co-signature (k-of-n of the verifier office keys, §6), so no single key-holder can unilaterally amend the obligations that bound their own work.

5.3 Enforcement and ratchet

Enforcement is at receipt-time (observed), never compile-time (rigid): deviations are recorded, the system keeps running, resolution is amend-or-fix — where "amend" is forward-looking only (§5.2.1). Over successive transitions the ceiling MAY ratchet toward the measured floor and reject regressions, without touching correctness obligations.

5.4 Granularity

The standard fixes no transition granularity. Granularity is discovered economically by the cheapest-sufficient discharge cascade: where per-transition discharge is cheaper than the obligation's risk warrants, transitions stay fine-grained; where it is not, obligations batch by composition (§3.3) until discharge clears at an acceptable tier, and the receipt records the batch boundary. The cascade's disclosed escalation makes the chosen granularity itself auditable. Conformance to a named coding-rule ruleset (MISRA C/C++, CERT, NASA Power of Ten) is naturally a cheap deterministic discharge tier and is carried in the discharge tier field like any other; JouleContract neither replaces nor contains such rulesets.

---

6. Independent Verification — no single verifier, no self-asserted trust

Conformant systems MUST designate a verifier of record distinct from the generator of the work; where one agent drafts both obligation and implementation, an independent checker MUST discharge the obligation. At SIL-3 and above, the verifier of record MUST be replaceable without invalidating prior receipts (verification authority attaches to the office and its published keys, not the incumbent), and implementations SHOULD support quorum verification (k-of-n independent verifiers) so that no single verifier's compromise, capture, or disappearance is a point of failure. This one requirement discharges the independent functional-safety assessment (IEC 61508), effective challenge (SR 11-7), and independent attestation (ISAE 3000), and corresponds to receiver-confirmation ("synthesis by receiver") in clinical handoff protocols such as I-PASS.

6.1 Discharge tiers: two classes, one qualified and one not

A discharge verdict trusted without subsequent re-verification makes the tier that produced it a trust target — the DO-330 tool-qualification lesson (TQL-1..5), the DO-333 requirement that the soundness of any formal method be justified (a sound method never asserts a property holds when it may not), and ISO 26262's tool confidence levels. The cascade is not exempt from the standard it serves — but the canon's qualification machinery applies only where it can:

• Deterministic tiers (type checkers, SMT backends, static analyzers, model checkers, coding-rule checkers): defined, reproducible, bounded behavior — qualifiable in the tool-qualification sense. Each deterministic discharge MUST reference its qualification binding: a signed attestation whose signer is distinct from both the tier operator and the generator, carrying an explicit validity window, with a chain terminating per §5.1.2. A reference that does not resolve, is expired, or is self-signed serializes as qualified:false — recorded as untrusted, never presented as qualified.
• Stochastic tiers (model-based discharge; any tier whose verdict samples a distribution): not qualifiable — there is no defined, reproducible behavior to qualify, and this standard does not pretend otherwise. A stochastic verdict MUST be recorded as unqualified, and MAY close an obligation only where that obligation is independently re-discharged by a deterministic tier or an independent verifier. A model verdict alone never satisfies a high-assurance discharge. (This is the cascade doctrine applied to verification itself: inference is a bounded last resort, not the control plane.)

The verifier of record validates qualification chains as part of discharge; a profile (§10) states the tier class and qualification validity required per obligation at a given Safety class.

6.2 Independence is computed, not asserted

Independence is declared per discharge, and it is derived from key disjointness, never copied from a producer-supplied flag: each discharge entry MUST carry the identity (DID/key) of the verifier that discharged it, and independent is true if and only if that discharge is signed by a key in the verifier set disjoint from the generator's key set. Where the keys overlap — or the discharge is unsigned by any verifier key — the entry serializes independent:false regardless of any claim made by the producer. The receipt-level verifier field is the derived union of per-discharge verifier identities, so per-obligation independence is checkable against per-obligation verifier identity from the receipt alone. The functional-safety canon requires independence (verifier ≠ developer) on specific objectives at the highest assurance levels (DO-178C DAL A/B), not uniformly; the profile (§10) states the independence required per obligation at a given Safety class.

6.3 Security of the generation loop

JouleContract secures the receipt; the generator is itself an attack surface — goal hijacking, tool misuse, context/memory poisoning, rogue sub-agents (OWASP AISVS, OWASP Agentic Top 10). JouleContract composes over it: a generator is itself a transition-executing system and — at SIL-3 and above — MUST operate under its own JouleContract, whose obligations bound tool scope, context integrity, and escalation authority, and whose receipts feed the same log.

Composition is not self-certification: a compromised agent would happily issue its own clean governance receipt. Therefore the generator-governing contract's obligations MUST be discharged by a verifier independent of the generator (§6.2 key-disjointness), its receipt's generator chain MUST terminate at a human-authored root (§5.1.2), and a generation-loop receipt discharged only by the generator itself serializes self_attested and is non-promotable. Below SIL-3, generator self-governance remains a SHOULD, with the same demotion rule when claimed.

---

7. Wire Format and Recognized-Edge Emission

Novel core, recognized edge. Contract and receipt serialize as canonical JSON (JSON Web Proof permitted for selective disclosure). A receipt MUST be expressible as an in-toto Statement with a JouleContract predicate type wrapped in DSSE, and MAY carry a SLSA provenance predicate. Signatures MUST verify with standard tooling; eIDAS qualified signatures/seals/timestamps for EU legal effect; FIPS 140-3 validated cryptography for US federal boundaries; signature schemes are algorithm-agile under §3.1. Governance mappings SHOULD emit as OSCAL; energy figures SHOULD be reportable as ISO/IEC 30134 KPIs and ISO 50001 EnPIs.

---

8. Regulatory and Standards Mapping

JouleContract element	Recognized standard / control
Discharged obligation + SIL grade	IEC 61508 assurance case & SIL; ISO 26262 / IEC 62304 / EN 50128; DO-178C (independent lineage)
Frame (no unintended function)	DO-178C absence of unintended function; ISO 26262 freedom from interference
Tier classes + qualification binding	DO-330 TQL (deterministic tiers); DO-333 formal-methods soundness; ISO 26262 TCL
Computed independence / quorum / per-obligation verifier binding	IEC 61508 FS assessment; DO-178C DAL-A/B independence; SR 11-7; ISAE 3000
Bound generator identity (AI-BOM)	OWASP AISVS App. C control AC.9.1 (L2); SLSA/in-toto builder identity; NIST SP 800-218A
Signed receipt per transition	21 CFR Part 11; NIST 800-53 AU; eIDAS
Amendment = metered, timestamped, signed transition	ISO/IEC 42001 change control; NIST 800-53 CM; SOX; DORA; eIDAS qualified timestamps
Continuous receipt log	NIST 800-53 CA ConMon; EU AI Act record-keeping; ISO 19011
Generation-loop security	OWASP AISVS; OWASP Agentic Top 10
Joule ceiling as EnPI vs EnB	ISO 50001
Energy provenance category	ISO/IEC 30134 measurement categories & unaccounted-energy rules
Residual + grid-mix	CSRD / ESRS E1; ISO/IEC 30134-8 (CUE)
Governance wrapper	ISO/IEC 42001 AIMS (certifiable per 42006); NIST SP 800-218 SSDF

---

9. Lineage

Hoare logic and Dijkstra's weakest precondition (the obligation generator) · Meyer's Design by Contract (pre/post/invariant in the signature; frame and joule ceiling are two more clauses) · the frame problem (McCarthy & Hayes) — what must be declared not to change — realized as a mutable-footprint declaration whose direct modern ancestors are modifies-clauses (JML assignable, Dafny modifies); separation logic's frame rule is admitted as a discharge technique for that footprint (local reasoning over disjoint state), not as the source of the clause · Knuth's literate programming (intent is the durable source; code is extracted) · the governance canon itself (IEC 61508 and the independently-evolved DO-178C family; ISO 50001; ISO/IEC 42001), composed rather than reinvented. The name "pseudocode" is declined as homage: pseudo means false, and this is the most rigorous artifact in the stack, not the least.

---

10. Conformance: a Composed Profile

JCAP = ⟨ Safety class, Energy class, Governance class ⟩

Safety class: SIL 1–4 (or sector equivalent). SIL-2+ requires generator-independent frame discharge (§3.4). SIL-3+ requires a bounded, discharged frame (an undischarged frame caps the class below SIL-3), per-obligation computed independence (§6.2), qualified deterministic tiers per obligation (§6.1), generator governance under §6.3, and quorum co-signature on frame/ceiling amendments (§5.2.1). SIL 4 additionally implies formal discharge by quorum verification.

Energy class: Metered > ModelBased > Unaccounted.

Governance class: AIMS maturity from declared to certified; an generator_unattested or self_attested receipt caps the class at declared.

The least-bound-axis rule. A profile tuple is only as trustworthy as its least-bound axis, and a class may only be claimed where its supporting fields are bound (§1), not merely named: SIL-3+ MUST NOT serialize unless qualification bindings resolve and independence is computed; certified MUST NOT serialize over an unattested generator. This prevents cross-axis halo — a receipt cannot decorate an Unaccounted energy figure with sham safety/governance trust and borrow credibility. A ⟨SIL-3, Metered, certified⟩ transition is categorically stronger than ⟨SIL-3, Unaccounted, declared⟩, and the profile says so. There is no single number to game, and no axis can be inflated by assertion.

10.1 The adequacy residual (named, not claimed closed)

JouleContract discharges stated obligations; it does not, and cannot, certify that the obligation set is complete against the behavior space. This residual is shared by the entire assurance canon — it is DO-178C's requirements-validation judgment and the ML-domain's operational-design-domain (ODD) coverage question (taken up by the forthcoming ED-324/ARP6983), neither of which any standard fully mechanizes. A standard that silently implied completeness it cannot have would contain illogic; JouleContract instead names the limit. A contract MAY carry an optional ODD-style domain annex declaring the input/operating domain over which its obligations are asserted to hold, making the boundary of the claim itself auditable.

---

11. Stewardship Succession — no organization as point of failure

Stewardship is an office. The protocol is ownerless; the steward maintains the Register (§13), publishes algorithm deprecations (§3.1), and convenes amendment review. The office is bound by:

• Fork-freedom. The specification license (CC-BY-4.0) and reference implementation license (Apache-2.0) guarantee that any party may continue the standard if the steward fails, defects, or captures. The ultimate succession mechanism is the license itself.
• Succession rule. The steward MAY transfer the office by signed amendment to this specification. If the steward is dissolved or unresponsive for a published timeout, any party maintaining a conformant reference implementation MAY assume interim stewardship by signed public declaration; competing claims resolve by implementer adoption, which the amendment log makes auditable.
• No retroactive authority. A steward cannot invalidate prior receipts or prior versions; all authority is forward-looking and exercised only through traced amendments. (The same direction-of-time discipline §5.2.1 imposes on contract producers.)

---

12. Security Considerations

The standard's security posture is the binding rule (§1): every trusted output is bound to what makes it trustworthy, or is recorded as untrusted — there is no implicit trust anywhere in the receipt, including in this standard's own vocabulary. Specifically:

• Generator spoofing is bounded by attestation binding: identity is a resolvable digest signed by a non-signer key, or generator_unattested (§5.1.1).
• Frame minimization / sham frame tiers are bounded by generator-independent frame discharge at SIL-2+, the observed/static_only mode disclosure, and the absence of any closed unbounded frame (§3.4).
• Qualification laundering is bounded by resolvable, validity-windowed, independently-signed qualification bindings with terminating chains; failures serialize qualified:false (§6.1, §5.1.2).
• Self-asserted independence is structurally impossible: independent is computed from key disjointness, never read from the producer (§6.2).
• Retroactive breach legalization is bounded by the temporal-ordering invariant: independently-timestamped amendments govern the future only (§5.2.1).
• Amendment flooding is bounded by metering (every amendment spends joules under a ceiling, §5.2) and by quorum co-signature on frame/ceiling amendments at high assurance (§5.2.1) — attribution alone does not bound volume; cost does.
• Estimator abuse is bounded by the non-promotion rule (§4.2); cross-axis halo — decorating a weak energy figure with inflated safety/governance trust — is bounded by the least-bound-axis rule (§10).
• Verifier capture is bounded by office/key separation and quorum (§6); generation-loop compromise is bounded by external discharge of generator governance and the self_attested demotion (§6.3).

---

13. Register (non-normative)

Current editions of inherited standards as of this version: IEC 61508:2010 (Ed. 2) · DO-178C/ED-12C + DO-330/331/332/333 (independent lineage, §2.1) · ARP4754A; ED-324/ARP6983 (in development, first publication expected 2026; Issue 1 scoped to frozen, supervised, non-adaptive ML up to DAL C) · ISO 26262 · IEC 62304 · EN 50128 · ISO 50001:2018 · ISO/IEC 30134-2:2026 · ISO/IEC 42001 (current edition; EN ISO/IEC 42001:2026 in the EU) · ISO/IEC 42005:2025, 42006:2025 · NIST SP 800-218 + 800-218A · OWASP AISVS v1.0 + Agentic Top 10 (2026) · eIDAS (Reg. 910/2014 as amended) · FIPS 140-3 · SLSA v1.2 · RFC 2119/8174. The Register is updated by steward amendment and never alters normative text by itself.

---

14. Lineage of this document's own holes (informative)

v0.4 closed six gaps surfaced by diffing v0.3 against the global AI-coding and regulated-code canons. v0.5 closes twenty findings surfaced by attacking v0.4 itself from three independent adversarial lenses — second-order regressions, new attack surfaces, canon fidelity. The pattern across both rounds is the law of this document's evolution: v0.4 fixed what the contract must say; v0.5 fixed whether what it says is bound to anything. Each adversarial pass reaches a thinner, more structural layer of the same discipline — no implicit trust anywhere, including in the vocabulary the standard itself introduces. The standard improves by being adversarially diffed, not by being defended; the diffs are part of its provenance (see joulecontract-diff-v0.3-global.md, joulecontract-diff-v0.4-self.md).

---

15. Terminology of demoted states (normative summary)

State	Meaning	Effect
undischarged (+ reason)	An obligation no tier closed — including any unboundable frame	Non-promotable; caps Safety class per §10
generator_unattested	Generator identity named but not bound to a non-signer attestation	Caps Governance class at declared
qualified:false	Qualification reference unresolvable, expired, or self-signed	Discharge counts as unqualified (§6.1)
independent:false (computed)	Discharge key set not disjoint from generator key set	Cannot satisfy independence requirements at any class
self_attested	Generation-loop receipt discharged only by the generator itself	Non-promotable (§6.3)
unterminated	A trust chain that reaches no defined root (§5.1.2)	Treated as unattested
Unaccounted	Energy estimated where the substrate exposes nothing	Never promotable (§4.2)
static_only	Frame bounded by analysis, not observed in execution	Weaker frame claim; profiles MAY require observed

Demotion is the standard's universal answer to unverifiable claims: record-as-untrusted, never forbid-and-drive-underground, never present-as-clean.

---

16. Amendment Log

Each entry: version, amends-digest, change, reason. The log is normative history; the standard practices its own §5.2.

v0.5.0 — amends sha2-256:<digest of v0.4.0>

1. §1 binding rule; §15 demoted-states table. Reason: v0.4 added the names of trust (generator, frame, qualification, independence) without binding them to a key, attestation, or timestamp — every new field was a string the incentivized producer could write and self-sign. The standard's own claim ("…or is recorded as untrusted") had no demotion mechanism. The binding rule is now global and the demoted vocabulary is normative. (Self-diff meta-finding; A1–A8, R6.)
2. §3.4: no closed unbounded frame — unboundable frames serialize undischarged; added discharge mode (observed/static_only); generator-independent frame discharge at SIL-2+. Reason: frame: unbounded as a closed discharge reopened, relabeled as disclosure, the exact hole §3.4 exists to close — and poisoned composition and made the SIL-4 frame guarantee vacuous. Demotion mirrors Unaccounted: a category, never a free pass. (R3, R5, R9, A2, A3.)
3. §3.3: composition never relicenses; undischarged frames propagate to the composition top; decomposition requires demonstrated independence (FFI + absence of common-cause failure). Reason: frame-union silently widened each component's permission and let one unbounded leaf de-frame a pipeline; and reducing ASIL decomposition to bare conjunction dropped the independence precondition that makes the pattern valid in ISO 26262-9. (R4, C2.)
4. §5.1.2 trust-chain termination at human-attested / reference-impl. Reason: v0.4 contained two unterminated MUST-recursions — who qualifies the qualifier (§6.1), and the generator-under-its-own-contract bootstrap (§6.3). The canon's own terminator (qualification grounds in assessor sign-off, not in another tool) is imported with the requirement this time. (R1, R2.)
5. §5.1.1: generator identity bound to a non-signer attestation or demoted generator_unattested; digests under §3.1 agility; names non-normative. Reason: a self-asserted generator block signed by its own author attested nothing; SLSA/in-toto bind builder identity to the platform's signing identity, and a receipt claiming to clear that bar must actually bind. (A1, R7.)
6. §5.2: amendments are metered transitions; §5.2.1 temporal-ordering invariant (independent timestamps; amendments govern the future only); quorum co-signature on frame/ceiling amendments at SIL-3+. Reason: without pre-commitment, a producer could retroactively widen a frame to legalize a detected breach; without metering, a key-holding insider could flood the amendment log (attribution bounds identity, not volume — cost bounds volume); without quorum, a single key-holder could amend the obligations bounding their own work. (A6, A7.)
7. §6.1 split into deterministic-qualifiable vs stochastic-unqualifiable tiers; qualification bindings must resolve, carry validity windows, and be independently signed, else qualified:false. Reason: DO-330 qualifies tools with defined, reproducible behavior — a stochastic model tier is categorically not qualifiable, and implying otherwise was a canon over-claim a domain expert would reject; and a qualification reference satisfiable by a self-signed rubber stamp bounded nothing. A model verdict alone never satisfies high-assurance discharge — inference is a bounded last resort, applied to verification itself. (C1, A4.)
8. §6.2: independence computed from key disjointness; verifier identity bound into each discharge entry; receipt-level verifier is the derived union. Reason: a producer-written boolean asserted by the party with the incentive to assert it bound nothing; and per-obligation independence finer than the receipt's global verifier field was unfalsifiable from the receipt. (A5, R6.)
9. §6.3: generator governance MUST at SIL-3+; discharged by a generator-independent verifier; self-issued loop receipts serialize self_attested, non-promotable. Reason: composition over the generation loop was presented as a defense while the inner receipt was produced by the generator about itself — circular; a compromised agent issues its own clean receipt. External discharge breaks the circle. (A9, R1-partial.)
10. §10: least-bound-axis rule; SIL-3+ requires bounded frame + computed independence + resolving qualifications; certified requires attested generator. Reason: the profile's anti-gaming claim held per-axis but not across axes — sham safety/governance fields could halo an Unaccounted energy figure. A class may be claimed only over bound fields. (A8, R5.)
11. §2.1 + §9 + §13 canon-fidelity corrections: DO-178C inherited on its own authority (predates IEC 61508; not a derivation); McCarthy/Hayes frame problem = the clause, separation logic's frame rule = a discharge technique (with JML/Dafny modifies-clauses as the direct ancestor); DO-333 soundness de-quoted to paraphrase; AISVS AC.9.1 scoped as an L2 control. Reason: precise claims only — each was a misattribution or over-claim that would discredit the spec in front of a domain reviewer. (C3, C4, C5, C7-nit.)
12. Cover/prime-directive claim reworded from absolute ("no point of failure or illogic") to the honest form §10.1 models: every point of failure named, graded, traced; the shared residual named, not hidden. Reason: a standard that correctly names a permanent unmechanizable residual cannot simultaneously claim absolute freedom from failure points; the cover claim inherits §10.1's honesty upward. (R8.)

v0.4.0 — amends sha2-256:<digest of v0.3.0>. Added frame as fifth obligation; generator identity; discharge-tier qualification; per-obligation independence; generation-loop composition; named the adequacy residual; resource-bound precise claim; security considerations.

v0.3.0 — amends sha2-256:<digest of v0.2.0>. Self-Hosting Clause; cryptographic agility; cross-domain ledger rule; economic granularity; verifier office + quorum; stewardship succession; inheritance by role with a Register; composition.

v0.2.0 — amends sha2-256:<digest of v0.1.0>. Re-founded all structure on the recognized canon (IEC 61508, ISO 50001/30134, ISO/IEC 42001); replaced the invented conformance ladder with the composed profile.

v0.1.0 — genesis. Core object (pre/post/inv/ceiling), receipt, amendment-as-transition, breach redefinition, energy-as-coordinate, verifier-of-record, recognized-edge emission.

---

Appendix A — Example (informative)

{
  "joulecontract": "0.5.0",
  "subject": "fn settle_batch(orders) -> Settlement",
  "pre":   ["all orders signed", "sum(debits) == sum(credits)"],
  "post":  ["ledger balanced", "each order has a settlement id"],
  "inv":   ["no order in two settlements", "no negative balance at any step"],
  "frame": ["ledger table", "settlement index"],
  "ceiling": { "enpi_joules": 3.0, "unit": "EOC-J", "enb_ref": "sha2-256:ab19…" },
  "amends": "sha2-256:9b2c…"
}

{
  "ReceiptPayload": {
    "contract":  "sha2-256:1f4a…",
    "transition":"sha2-256:77de…",
    "generator": {
      "system": "joulecode-agent",
      "model": "claude-opus-4-8",
      "version_digest": "sha2-256:5c0d…",
      "attestation": { "ref": "sha2-256:77aa…", "signer": "did:web:model-registry.example", "binding": "attested" },
      "human_principals": ["did:web:eng-a.example"],
      "context": "ticket SETL-4821",
      "loop_governance": { "contract": "sha2-256:90ef…", "discharged_by": "did:web:audit-a.example", "root": "human-authored" }
    },
    "discharge": [
      { "obligation": "ledger balanced",     "tier": "JP-L1-typecheck", "tier_class": "deterministic", "result": "closed",
        "qualification": { "ref": "sha2-256:q1…", "signer": "did:web:assessor.example", "valid_until": "2027-06-01", "root": "human-attested", "qualified": true },
        "verifier": "did:web:audit-a.example", "independent": true },
      { "obligation": "no negative balance", "tier": "JP-L3-smt",       "tier_class": "deterministic", "result": "closed",
        "qualification": { "ref": "sha2-256:q2…", "signer": "did:web:assessor.example", "valid_until": "2027-06-01", "root": "reference-impl", "qualified": true },
        "verifier": "did:web:audit-b.example", "independent": true },
      { "obligation": "frame: ledger+index", "tier": "JP-L2-separation","tier_class": "deterministic", "result": "closed", "mode": "observed",
        "qualification": { "ref": "sha2-256:q3…", "signer": "did:web:assessor.example", "valid_until": "2027-06-01", "root": "human-attested", "qualified": true },
        "verifier": "did:web:audit-a.example", "independent": true }
    ],
    "execution": ["JC-L0-cache", "JC-L3-model"],
    "joules_spent": 2.1,
    "joules_allowed": 3.0,
    "residual": 0.9,
    "provenance": "Metered",
    "enb_ref": "sha2-256:ab19…",
    "grid_mix": { "renewable": 0.61, "region": "eu-w-1" },
    "verifier": ["did:web:audit-a.example", "did:web:audit-b.example"],
    "profile": { "safety": "SIL-3", "energy": "Metered", "governance": "certified" },
    "timestamp": { "authority": "did:web:tsa.example", "qualified": true, "at": "2026-06-10T14:02:11Z" },
    "signature": "eIDAS-QES…"
  }
}

Note the example is now checkable from the receipt alone: every independent: true is verifiable against a verifier key disjoint from the generator's; every qualification resolves to an independently-signed, validity-windowed attestation with a terminating root; the generator binds to a registry-signed attestation; the frame was observed, not merely analyzed; and the timestamp is external. The SIL-3 profile claim is legal under §10 because every supporting field is bound.

---

End of v0.5.0 — a traced amendment of v0.4.0 under the standard's own §5.2, with the self-diff that motivated it recorded in its provenance.